The Italian Authority for Communications Guarantees (AGCOM) issued a formal administrative order (Delibera N. 333/25/CONS) fining Cloudflare, Inc. approximately €14.25 million (equating to 1% of its 2024 global revenue) for continued failure to comply with a binding order issued in February 2025. The fine is rooted in Cloudflare's non-compliance with Italy's "Piracy Shield" legislation (Legge antipirateria), which mandates service providers—including DNS and content delivery networks—to block access (via DNS resolution and IP routing blocks) to identified copyright-infringing content, primarily relating to live sports events, within 30 minutes of notification. Cloudflare’s defense, citing technical infeasibility and the disproportionate impact of global filtering, was rejected by AGCOM, which classified Cloudflare’s services as actively facilitating infringement. The resulting public response from Cloudflare's CEO was characterized by extreme political rhetoric, threats of corporate divestiture from the Italian market (including withdrawal of pro bono services for the 2026 Winter Olympics), and explicit appeals for diplomatic intervention from high-ranking U.S. administration officials.
Regulatory Dispute: Cloudflare vs. Italian Communications Regulator (AGCOM)
AGCOM Regulatory Action (Delibera N. 333/25/CONS): Issued the final injunction on December 29, 2025, confirming a fine of €14,247,698.56 against Cloudflare for repeated non-compliance with a prior order (Delibera N. 49/25/CONS).
Basis for the Fine: The fine cites Cloudflare’s failure to implement technological and organizational measures necessary to render illegally diffused content (specifically audiovisual works related to live sporting events) inaccessible to end-users, as required by Article 2, Paragraph 5 of the Italian Anti-Piracy Law.
Legal Mandate: The law requires service providers, including DNS providers like Cloudflare, to disable access (DNS resolution blocks and IP routing blocks) to infringing content and future variant domains within a maximum of 30 minutes of notification from rights holders (e.g., Serie A football leagues).
Contributory Infringement: AGCOM rejected Cloudflare’s claims of being a neutral intermediary, citing prior judicial rulings (Tribunale di Roma, Tribunale di Milano) that found Cloudflare's reverse proxy activity constitutes "concorso nell’illecito" (contributory infringement) by masking the origin of the illegal content.
Fine Calculation: The penalty was set at 1% of Cloudflare's global revenue (2024 total of $1.67 billion), justified because Cloudflare's global infrastructure enables the illicit access for Italian users, and the fine must be "adequately afflittiva" (sufficiently punitive) relative to the company's global economic capacity, mirroring practices in other EU regulations (e.g., GDPR, DSA).
Compliance Duration: AGCOM noted that the non-compliance was continuous, having been observed in verification checks spanning from May 2025 through October 2025, following the original order issued March 7, 2025.
Cloudflare’s Technical Defense (Rejected): Cloudflare argued that filtering their global 1.1.1.1 DNS resolver was technically impractical, disproportionate, and would negatively impact latency for 200 billion daily requests, including those for non-infringing sites. AGCOM found this argument "pretestuose e dilatorie" (pretextual and dilatory).
Cloudflare CEO Response (Jan 9, 2026): Matthew Prince condemned the action as "DISGUSTING" global censorship imposed by a "shadowy cabal of European media elites," lacking due process.
Corporate Retaliation Threats: Cloudflare is publicly considering four immediate actions, including terminating the multi-million dollar pro bono cyber security services provided to the Milano-Cortina 2026 Winter Olympics, discontinuing free cyber security services for Italy-based users, removing all servers from Italian cities, and halting all future investments in the country.
Political Escalation: The CEO explicitly appealed to US political figures (JD Vance, Elon Musk) to recognize the regulation as a "fundamental unfair trade issue," announcing meetings with U.S. administration officials and the International Olympic Committee (IOC) to leverage potential withdrawal of cyber security protection for the Games.